{"record":{"id":"09ec2068abfe065b","repo":"TryGhost/Ghost","slug":"could-not-determine-origin-of-request-please-ensu","errorCode":null,"errorMessage":"Could not determine origin of request. Please ensure an Origin or Referrer header is present.","messagePattern":"Could not determine origin of request\\. Please ensure an Origin or Referrer header is present\\.","errorType":"exception","errorClass":"BadRequestError","httpStatus":400,"severity":"error","filePath":"ghost/core/core/server/services/auth/session/session-service.js","lineNumber":173,"sourceCode":"    /**\n     * isVerificationRequired\n     * Determines if 2FA verification is required based on site settings\n     * @returns {boolean}\n     */\n    function isVerificationRequired() {\n        return getSettingsCache('require_email_mfa') === true;\n    }\n\n    async function assignUserToSession({\n        session,\n        user,\n        origin,\n        userAgent,\n        ip,\n        verificationToken\n    }) {\n        if (!origin) {\n            throw new BadRequestError({\n                message: 'Could not determine origin of request. Please ensure an Origin or Referrer header is present.'\n            });\n        }\n\n        if (session.user_id && session.user_id !== user.id) {\n            invalidateAuthCodeChallenge(session);\n        }\n\n        session.user_id = user.id;\n        session.origin = origin;\n        session.user_agent = userAgent;\n        session.ip = ip;\n\n        // If a verification token was provided with the login request, verify it\n        if (verificationToken) {\n            const secret = getSettingsCache('admin_session_secret');\n            const isAuthCodeVerified = verifyAuthCode(session, verificationToken, secret);\n","sourceCodeStart":155,"sourceCodeEnd":191,"githubUrl":"https://github.com/TryGhost/Ghost/blob/47d8b0e2ad2fd4757d3bc45f46c3ac165ff8a1fe/ghost/core/core/server/services/auth/session/session-service.js#L155-L191","documentation":"A BadRequestError from `assignUserToSession` when `origin` is falsy. Ghost derives the request origin from the `Origin` header first, then falls back to `Referer`; if neither is present it cannot bind a trusted origin to the session and refuses to proceed. This is the login/session-creation path, so a missing origin is treated as an untrustworthy request.","triggerScenarios":"A login or session-initiation request that carries neither an `Origin` nor a `Referer` header — e.g. a direct `fetch`/`curl` without those headers, a browser request that strips them, or a privacy/proxy setup that removes both.","commonSituations":"Calling the session/auth endpoints from a server-side script or `curl` with no `Origin`/`Referer`; a strict privacy browser or extension stripping these headers; a non-browser client (CLI/SDK) hitting the user-facing auth flow instead of the API-key flow; a redirect chain that drops the `Referer`.","solutions":["Send an `Origin` header matching the configured admin URL on the request.","For automation/integrations, use the Admin API with a Staff token/key instead of the browser session flow.","Disable the browser extension/config that strips `Origin`/`Referer` for the admin domain.","Ensure any reverse proxy forwards the original `Origin`/`Referer` headers to Ghost."],"exampleFix":"// before\ncurl -X POST https://example.com/ghost/api/admin/session/ -d '...'\n\n// after\ncurl -X POST https://example.com/ghost/api/admin/session/ \\\n  -H 'Origin: https://example.com' \\\n  -H 'Content-Type: application/json' \\\n  -d '{...}'","handlingStrategy":"validation","validationCode":"function ensureRequestOrigin(headers) {\n  const origin = headers.origin || (headers.referer ? new URL(headers.referer).origin : null);\n  if (!origin) throw new Error('Missing Origin/Referer header; cannot bind session origin');\n  return origin;\n}","typeGuard":"const hasOriginOrReferer = (h) => Boolean(h?.origin || h?.referer);","tryCatchPattern":"try {\n  await api.session.create(credentials);\n} catch (err) {\n  if (err.type === 'BadRequestError' && /Origin or Referrer/i.test(err.message)) addOriginHeader();\n  else throw err;\n}","preventionTips":["Always send an Origin header on session/auth requests.","For automation, use the Admin API key flow, not the browser session flow.","Disable header-stripping extensions for the admin domain."],"tags":["session","origin","security","auth","headers"],"backgroundTag":null,"analyzedSha":"47d8b0e2ad2fd4757d3bc45f46c3ac165ff8a1fe","analyzedAt":"2026-08-13T01:25:26.651Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}